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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

!)□ Responsive to Gommunication(s) filed on 10 January 2005 . 
2a)S This action is FINAL. 2b)n This action is non-final. 

3) n Since this application is in condition for allowance except for fonrial matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1 935 CD. 1 1 , 453 O.G. 21 3. 

Disposition of Clainfis 

4) ^ Claim(s) 1-12 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) S Claim(s) 4 is/are allowed. 

6) 13 Claim(s) 1-3 and 5-12 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing{s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) Including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 ,□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



1. 



The amendment of 1/10/05 has been received and entered. 



2. 



Claims 1-12 are pending. 



3. 



Claim 4 is allowable. 



Response to Arguments 



4. Applicant has argued on page 7, last paragraph - page 8 paragraph 1 : 

It is respectfully submitted that even if the use of an INT instruction is well known to those of 
skill in the art, this does not mean that is it known or obvious to use an INT instruction combined 
with a branch instruction as claimed in claims 1-3, 5-9 and 12 for obfuscating computer program 
instructions upon disassembly. 

The Examiner contends however that if one of ordinary skill in the art takes into account what 
the INT is designed to do, such modification does become obvious. 

An interrupt handler for example will receive an interrupt, specifically because another set of 
instructions is to be executed at that moment. For that reason, a processor must first, interrupt 
the flow of instructions, (the INT), and then use a branch instruction to redirect the flow of 
execution to another thread or process. Previously this was not disclosed in any art cited by the 
Examiner. Support is given in this action with "Operating System Concepts", Silberschatz et al. 
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Applicants further arguments are moot in view of the new grounds of rejection. 

Examiner's Comments 
For the purposes the clarifying the record, the Examiner notes that he has interpreted claim 
language which recites the insertion of a particular code such as 
JMP $+4 
INT35h 

as being adjacent instructions retaining the order in which the instructions are executed. One of 
ordinary skill in the art would reasonably construe a code fragment as a set of adjacent ordered 
instructions. It is worthy of note that in the art, interpreting the instructions in the code fragment 
nonadjacently or out of order, would often completely destroy the function and purpose of the 
code. 

This can be best illustrated with an analogy for an algorithm to get milk from a refrigerator. 

• Obtain glass cup 

• Pour milk 

• Drink contents of cup 

• Wash glass cup 

Would have a completely different output than 

• Obtain glass cup 

• Drink contents of cup 

• Wash glass cup 

• Pour Milk 
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Furthermore although Applicant has recited in the specification that the two instructions need not 
be adjacent to one other, this broader limitation has been claimed in a different manner, such as 
in claim 1 . 

Claim Rejections - 35 USC § 101 

5. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 10 and 1 1 are rejected under 35 USC 101 because the claimed invention lacks 
patentable utility. Claims 10 and 1 1 merely recite a set of programmable instructions on 
a computer readable media, however the instructions on the media do not perform a 
useful task. Specifically the execution of 

JMP $+4 -jumps the flow of execution 4 bytes fonA/ard relative to the current position, 
(in the case of 32 bit processors, this merely jumps the execution to the next word) 

INT 35h - gets the interrupt vector. 

INT 20h - terminates execution of the program. 
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The Examiner notes executing the instructions results in no output. While it is the 
Examiner's position that the obfuscation of code has a practical usage in it's respective 
technological art, there is no practical usage if there is no code to obfuscate. Applicant 
has merely claimed a readable media containing the instructions as set forth without 
disclosing any of the structural elements necessary for the obfuscating code to perform 
on. Without any instructions to manipulate or any code to obfuscate, the recited code 
on the readable media as claimed lacks patentable utility. 



Claim Rejections - 35 USC § 103 

7, The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

8. Claims 1-3, 5-12 rejected under 35 U.S.C. 103(a) as being unpatentable over Granger et 
aL (Granger), US patent 6,643,775 and Operating System Concepts, fifth edition, Silberschatz et 
al. 



In reference to claim 1 : 

Granger discloses a method for obfuscating computer program instructions upon disassembly the 
method comprising: 
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• Inserting an instruction for causing a disassembler to not disassemble one or more bytes 
subsequent to the instruction; (Column 19, lines 5-22) 

• Inserting a branch instruction to invoke execution of one or more bytes subsequent to the 
instruction. (Column 23, line 62 - Column 24, line 3) 

Granger fails to explicitly disclose an embodiment wherein the instruction used is an interrupt. 

Operating System Concepts, fifth edition, Silberschatz et al. Figure 12,3 and pages 402-404 
discloses inserting an interrupt for causing a currently executing program to not continue its 
execution of instructions subsequent to the interrupt instruction. 

Operating System Concepts, fifth edition, Silberschatz et al. Figure 12.3 and pages 402-404 
discloses inserting a branch instruction to invoke execution of one or more bytes subsequent to 
the instruction, where the branch instruction is the "return from interrupt" instruction. 

Operating System Concepts, fifth edition, Silberschatz et al. teaches that the basic interrupt 
mechanism enables the CPU to respond asynchronous events. 

It would have been obvious to one of ordinary skill in the art at the time of invention to use an 
interrupt handler to interrupt the obfiiscating computer program method of Granger in order to 
allow the computer to respond to asynchronous events in the meantime. 



In reference to claim 2: 
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Neither Granger nor Operating System Concepts, fifth edition, Silberschatz et al. explicitly 
discloses the method of claim 1 and comprising repeating said inserting an interrupt instruction 
and said inserting a branch instruction. 

However, such a modification would only involve a second interrupt of the obfiiscation process 
in Granger, As Operating System Concepts, fifth edition, Silberschatz et al, has stated, the 
events forming an interrupt are asynchronous and are prone to happy at any time. 

It would have been obvious to one of ordinary skill in the art at the time of invention to repeat 
the insertion of the interrupt instruction and then following with the insertion of a branch 
instruction to return to execution in order to respond to a second asynchronous event. 

In reference to claim 3 : 

Granger and Operating System Concepts, fifth edition, Silberschatz et al. discloses the method of 
claim 1, wherein said branch instruction is a jump instruction. 

The Examiner considers jump type instructions to be inherent to branch instructions. The two 
types of instructions are virtually synonymous with one another. A branch instruction is 
understood as an instruction 

"To relinquish control to another set of instructions or another routine as a resuh of the presence 
of a branch." 
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The Jump instruction is an instruction understood to mean: 

"To move from one set of instructions in a program to another out of sequence." 

(Taken from htt p :/ /www. dictionary . com) 

A branch inherently contains a "jump" when it reUnquishes control to another routine, even 
though this may be dependent on a particular condition (conditional branches). 



In reference to claim 5 : 

Granger et al. discloses a method of obfuscating computer instructions upon disassembly 
wherein the steps are performed manually. (Column 22, table 2) provides a list of obfuscation 
rules that though intended to placed there by a software mechanism, can clearly be inserted 
manually if so desired by following the obfuscation rules in the given Ust. 

In reference to claim 6: 

Granger et al. discloses a method wherein the steps are performed by a software process. 
(Column 19, lines 34-41) 

In reference to claim 7: 

Granger and Operating System Concepts, fifth edition, Silberschatz et al. discloses a method 
wherein parameters are suppUed to the software process, the method further comprising: 
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Supplying a parameter to the software process to specify the frequency that an obfuscating 
instruction is to be inserted in a predetermined program. (Column 20, line 59 - Column 21, line 
6) 

In reference to claim 8: 

Granger et al. fails to disclose a method wherein the frequency is specified as a number of 
instructions of the predetermined program between each insertion of the interrupt instruction. 

The examiner takes official notice that mechanisms with which a frequency or magnitude of 
action can be adjusted are common and well known in the art. Granger et al. for example 
discloses a method wherein the frequency of obftiscation code is specified as a number of 
instructions of the predetermined program, or some multiple thereof 

It would have been obvious to one of ordinary skill in the art at the time of invention to specify 
the frequency of the obfuscation as a number of the instructions of the predetermined program 
between each insertion, as a matter of design choice. The greater the frequency, the greater the 
obfuscation, but more processing power is needed. 

In reference to claims 10 and 1 1 : 

A computer readable media including the following obfuscating instructions executable by a 

processor: 

JMP $+4 
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INT 20h 

The Examiner notes that each of these instructions were well known in the art at the time of 
invention. INT 35h is the interrupt to 35h which performs the function of getting the interrupt 
vector, where INT 20h invokes program termination. ("Programmer's Guide to the IBM PC", 
Peter Nortion, 1985, Microsoft Press, pgs, 303, 49, Figure 3-1) 

IMP $+4 is a command to allow program execution to jump 4 bytes from the current point in 
execution, which is the size of a single word for a 32-bit system. 

The Jump command is disclosed in Turbo Assembler, V 2.5, p.292. 

It would have been obvious to one of ordinary skill in the art at the time of invention to include 
the instructions above as a termination sequence for a program. 

Claims 9, 12 are rejected for the same reasons as claim 1, 

Conclusion 

9. THIS ACTION IS MADE FINAL, AppUcant is reminded of the extension of time poHcy 
as set forth in 37 CFR 1 .136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of the final action and the advisory action is not mailed under afl;er 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension pursuant to 37 CFR 
1 .136(A) will be calculated fi^om the maiUng date of the advisory action. In no event, however, 
will the statutory period for reply expire later than SIX MONTHS from the mailing date of this 
final action. 

10. Any inquiry concerning this communication fi-om the examiner should be directed to 
Thomas M Ho whose telephone number is (571)272-3835. The examiner can normally be 
reached on M-F from 9:30 AM - 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Gregory A, Morse can be reached on (571)272-3838. 

The Examiner may also be reached through email through Thomas.Ho6@uspto.gov 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (571)272-2100. 

General Information/Receptionist Telephone: 57 1 -272-2 1 00 Fax: 703-872-9306 
Customer Service Representative Telephone: 571-272-2100 Fax: 703-872-9306 



TMH 




April 14 , 2005 



SUPERVISORY r;'^ 



